Terraform "Resource already managed by Terraform" on import in CI

By Daniel Zoghalchali·Latchkey

terraform import (or an import block) maps a real resource to a state address. If that address already holds a managed resource, the import is refused because Terraform will not overwrite an existing entry.

What this error means

apply/import fails with "Resource already managed by Terraform", naming the address. It appears when an import block re-imports an already-imported resource, or two imports target the same address.

terraform

Error: Resource already managed by Terraform

Terraform is already managing a remote object for aws_s3_bucket.assets. To import
to this address you must first remove the existing object from the state.

Common causes

Address already in state

The target resource address already holds a managed object, so importing onto it would clobber the existing entry.

Import block left in after a successful import

A one-time import block that already ran is re-applied on the next run, which re-imports an address that now exists in state.

How to fix it

Remove completed import blocks

Once an import block has run successfully, delete it (or the resource is already managed) so subsequent applies do not re-import.

imports.tf

# delete the now-completed import block:
# import {
#   to = aws_s3_bucket.assets
#   id = "my-app-bucket"
# }
terraform plan -input=false   # confirm no import is proposed

Resolve genuine address collisions

If you must re-import, terraform state rm the existing address first.
Confirm two imports are not targeting the same address.
Re-run plan to verify the address is managed exactly once.

How to prevent it

Treat import blocks as one-shot and remove them after they run.
Avoid two imports targeting the same address.
Run plan to confirm no unexpected import remains.

Frequently asked questions

What causes ""Resource already managed by Terraform""?